Splunk Search

Linux Successful Login

garima_chauhan
Path Finder

Hi,

I want to create a query displaying successful logins in Linux. I have /var/log/secure logs but I cannot find anything like login,authentication successful or any other related keyword in these logs. I tried with the wtmp logs as well but I will have to provide a script in that case.
My linux box does not have auth.log. Please suggest as to which log file shall I monitoror if there is an easier way of monitoring the wtmp logs in readable format.

Tags (2)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi garima_chauhan,

this is more likely a problem of your Linux box, then a Splunk problem. I suggest that you ask Dr. Google regarding where your Linux distribution stores this kind of information. After that you can follow the docs on how to get data into Splunk.

Remember your data must be human readable, meaning a non-binary file.

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi garima_chauhan,

this is more likely a problem of your Linux box, then a Splunk problem. I suggest that you ask Dr. Google regarding where your Linux distribution stores this kind of information. After that you can follow the docs on how to get data into Splunk.

Remember your data must be human readable, meaning a non-binary file.

hope this helps ...

cheers, MuS

MuS
SplunkTrust
SplunkTrust

no problem - feel free to accept the answer

0 Karma

garima_chauhan
Path Finder

I do not know what the issue was, but now I am able to see an entry like: Accepted password for username in the logs.
Thanks.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>